Node and Workload Attestation Flow

Node and Workload Attestation Flow A workflow diagram generated by Archify. 01 / Kubernetes workload / API 02 / SPIRE Agent 03 / Node (EC2 / OS) 04 / SPIRE Server Node Attestation Workload Attestation k8s_psat · Obtain ServiceAccount Token · Kubernetes workload / API › Node Attestation k8s_psat Obtain ServiceAccount Token Call Workload API · Unix socket · Kubernetes workload / API › Workload Attestation Call Workload API Unix socket Look up Pod metadata · k8s workload attestor · Kubernetes workload / API › Workload Attestation Look up Pod metadata k8s workload attestor Deliver Workload SVID · Cache / server renewal · Kubernetes workload / API › Workload Attestation Deliver Workload SVID Cache / server renewal SPIRE Agent starts · DaemonSet · SPIRE Agent › Node Attestation SPIRE Agent starts DaemonSet Agent SVID acquired · Agent identity established · SPIRE Agent › Node Attestation Agent SVID acquired Agent identity established Collect process info · Identify calling process · SPIRE Agent › Workload Attestation Collect process info Identify calling process Match selectors · Synchronized agent entries · SPIRE Agent › Workload Attestation Match selectors Synchronized agent entries aws_iid · Obtain Instance Identity Doc · Node (EC2 / OS) › Node Attestation aws_iid Obtain Instance Identity Doc Check UID/GID · unix workload attestor · Node (EC2 / OS) › Workload Attestation Check UID/GID unix workload attestor Validate attestation · Submitted token/document · SPIRE Server › Node Attestation Validate attestation Submitted token/document Agent ready Legend Workload SPIRE processing step SVID issuance Attestation evidence